CVE-2026-76225

ArcadeDB before 26.8.1 Server-Side Request Forgery via LOAD CSV

8.3 High

ArcadeDB before 26.8.1 contains a server-side request forgery vulnerability in the OpenCypher LOAD CSV implementation that fails to validate HTTP/HTTPS URLs. Authenticated attackers can craft LOAD CSV queries pointing to internal network addresses or cloud metadata endpoints to make the ArcadeDB server fetch and return sensitive data from restricted services.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.35%Up 0.1 points since Aug 20, 2026

What each source reports

CVE List Score used 8.3

ArcadeDB before 26.8.1 Server-Side Request Forgery via LOAD CSV

Record: CVE-2026-76225
CVSS 4.0: 8.3 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
CVSS 3.1: 7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness: CWE-918
Updated: 2026-11-02

EUVDEUVD-2026-62466 8.3

Record: EUVD-2026-62466
CVSS 4.0: 8.3 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-57m4-3m25-xp8f 8.3

ArcadeDB before 26.8.1 contains a server-side request forgery vulnerability in the OpenCypher...

Record: GHSA-57m4-3m25-xp8f
CVSS 4.0: 8.3 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness: CWE-918
Updated: 2026-11-02

NVD 8.3

Record: CVE-2026-76225
CVSS 4.0: 8.3 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness: CWE-918
Updated: 2026-11-02

OSV 8.3

ArcadeDB before 26.8.1 Server-Side Request Forgery via LOAD CSV

Record: CVE-2026-76225
CVSS 4.0: 8.3 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Weakness: CWE-918
Updated: 2026-11-02

Affected products

arcadedata arcadedb

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-76225 is a high vulnerability (CVSS 8.3) in Arcadedata Arcadedb, published August 19, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 29th percentile. No source names a fixed version.